Security & Data Handling
How CostTrak's current architecture handles your data. Effective July 24, 2026.
Data storage
Application data is stored in a managed PostgreSQL database. Row-level security is enabled on every table, and the application connects through a dedicated backend service rather than exposing the database directly to clients.
Encryption in transit
CostTrak is served over HTTPS. Traffic between your browser and CostTrak's servers is encrypted in transit.
Authentication
Passwords are hashed before storage and are never stored in plain text. API access uses signed, time-limited bearer tokens issued at login.
Access controls
Data is scoped per organization. Customer portal accounts can only access their own jobs and quotes; internal roles (owner, admin, staff) control access to settings, analytics, and admin tools within an organization.
Third-party service providers
CostTrak runs on Vercel for hosting and a managed PostgreSQL provider for the database. When configured, job photo uploads use Vercel Blob storage, and AI-assisted job analysis sends job text and photos to Anthropic's API to generate the analysis.
Banking integrations
CostTrak does not integrate with bank accounts, payment processors, or card data. No banking credentials are collected or stored.
Does CostTrak sell customer data?
No. CostTrak does not sell customer or contractor data to third parties.
Data export
Quotes and invoices can be exported as PDF today. Broader account data export (CSV/JSON) is planned but not yet available.
Account deletion
Reach us through the Contact page to request deletion of your account or your organization's data.
Reporting a security issue
Reach us through the Contact page with details of the issue. We investigate every report.